Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d9181d4da3dfc22c8fead200c0d86ea0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d9181d4da3dfc22c8fead200c0d86ea0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.d9181d4da3dfc22c8fead200c0d86ea0.exe
-
Size
122KB
-
MD5
d9181d4da3dfc22c8fead200c0d86ea0
-
SHA1
a5b02433161d54b4290f9898d0933566cbba479e
-
SHA256
e09b37b492e486ccc03698a60012c589dc1955cb385503bb58be8e22ad463f80
-
SHA512
cfa316342846e71dafae170c7a75838d44f2c65e5fa578439a116277ef4773b43f37d925882e58fb4cb85ded38761fb1131105642bd935f625543d8d634a0df8
-
SSDEEP
1536:YaUZTCV1mCpAPQXyTpiZ5sj9JWwnCU/+HSMC2piVuO80XtUCuCmw7hM9502O8pka:EZTCV1mCpAPMg4wSJrwdHmw7hi50dGb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.d9181d4da3dfc22c8fead200c0d86ea0.exe
Files
-
NEAS.d9181d4da3dfc22c8fead200c0d86ea0.exe.exe windows:5 windows x86
4dc2867cde04707fee91ead401591b1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
LocalFree
CreateThread
CreateFileA
HeapAlloc
WriteFile
GetVersionExW
GetLastError
GetModuleHandleA
GetComputerNameA
InterlockedIncrement
InterlockedDecrement
GetVolumeInformationA
GetTickCount
GetCurrentProcessId
GetVersionExA
GetVersion
Sleep
GetExitCodeProcess
CreateProcessA
GetTempPathA
lstrcpyA
FlushFileBuffers
WinExec
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
VirtualFree
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ReleaseMutex
CreateMutexA
GetModuleFileNameA
LocalAlloc
LoadLibraryA
GetProcAddress
TerminateThread
GetProcessHeap
WaitForSingleObject
HeapFree
FreeLibrary
lstrlenA
GetStdHandle
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RaiseException
user32
TrackPopupMenu
GetMenuItemID
KillTimer
GetSubMenu
SetForegroundWindow
LoadMenuA
FindWindowA
RegisterWindowMessageA
GetCursorPos
DrawMenuBar
PostMessageA
SetMenuDefaultItem
DestroyMenu
DestroyWindow
GetMessageA
RegisterClassExA
PostQuitMessage
GetParent
LoadIconA
SendMessageA
TranslateMessage
CreateWindowExA
EnableMenuItem
DefWindowProcA
DispatchMessageA
advapi32
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
FreeSid
AllocateAndInitializeSid
RegDeleteValueA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclA
shell32
Shell_NotifyIconA
oleaut32
VariantClear
shlwapi
AssocQueryStringA
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ